3dc822c653b95b031cf5a174d7fc4313ecec48e31a734f76f0a6f950f7aa5ed0

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c123416253d8afaa6ade8c3f095c14ff_JaffaCakes118.html
Size

22KB
MD5

c123416253d8afaa6ade8c3f095c14ff
SHA1

43b416021d7f39298da101046a65e37c386eac6e
SHA256

3dc822c653b95b031cf5a174d7fc4313ecec48e31a734f76f0a6f950f7aa5ed0
SHA512

f14cb0aca82161cdd965d6a7d97418b8536eface8d923d831677479b4b3da5e1588cbd7b419e038352b05c9b012adbb5556ce803f49ff19c36f10e8ba8da3468
SSDEEP

192:uwF0Cv3PeV39bb5n0VlYKYUVHo1FZcbfZnQjxn5Q/ifnQieOKNn3r8nQOkEntoTR:kQ/Vv06k/A

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AF88871-62FF-11EF-B856-666B6675A85F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430765329"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3012	2380	iexplore.exe	29
PID 2380 wrote to memory of 3012	2380	iexplore.exe	29
PID 2380 wrote to memory of 3012	2380	iexplore.exe	29
PID 2380 wrote to memory of 3012	2380	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c123416253d8afaa6ade8c3f095c14ff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0267d3c2fa76c2932ba7275c6354d5e2

SHA1
2225f5f570bdbdb1040dd11950f9ce4dfcb28d2b

SHA256
8488d244aab675834e706f10cbb86293fa531db39a880544011276d3a668c9f9

SHA512
503d7014af3ef4da72ee27cae436f31163e39e0b8a070b3a3d7f350dfc8ae1884dd6125e60fa8607a5f18fabff6fa419325aa5dd16c789507e060e466476f672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f490997d59c4fbd09923fb4e105f914d

SHA1
d9b85f15521fde988f15951a348bea9f89c81e43

SHA256
1919aa3106b9490b22826ee6f791700767427a9cb15aae2477a80410d319ab8d

SHA512
b0584f4b2144d8cf8bb45d361087beda6c25d241c1b63181ff4d49067409bcce264acdc31d1d516939913f28544ce52cf0cc7a9f43a6e14d57fc50cd87e253f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fe6c71294cff836df295d94c5001974

SHA1
caef68326e546bcdc15aa6126b5b0e3d6465dc13

SHA256
990b141b8438455677e2262e27c1822ccfa8799446b5a97c9ad0116b1bb82d3e

SHA512
8c2df793ea5b08ec8ba9c09d7d948846c2d6e83564e0c6e952147b6876041d684c51872686ba272ce4c3841926d70608680c9517d8642f4ae63584bb1f15dd02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e71f422821c8a16150f5e54e400aa91

SHA1
55896ac3ad60bbd16b76dc46f833839c3959014a

SHA256
03dbd0b6d1049446eaf3efda8e51d9bf8ba18f112517f7114329fa36dc49333f

SHA512
16ecb9f84e311bd3fe54d7fbdb20f7cea37ac7e8c5a5d55cb70e1e736c79100c5490757ce3a4b1ad081b77a3022633dbecd12f3a5a7b0007bd0ac43f71100a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6261c5b05f1dec59dd03b2d4d53a0e34

SHA1
7e1d4e933b2e357f8fa8c3f71fc4f9031c9f1882

SHA256
c75d8328709a0364d5a9cda27399c0e9ffb66ffbd109611601c7700edff95d7e

SHA512
c2960f5f188d153cd2015dea1685a84b1751936e35b35b9031c6ccb3dd069bc17f2bab0995c750a89cb3a0063cd4c268631bcae187f971e6d86c50ff23e37496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
852a5e1a61fed5d228e3b925bacf64af

SHA1
6a5f530b56d6b2994b5a6f579289fd941d1f80af

SHA256
2a266ef6ac182a411a18c6473b9bab1768197818eb8f63df8e3eb1baf4692dbb

SHA512
a08c5b1f45d8f97894d0fd4761ade5790978c95009113d667fbe93cec24e10cc5e986950f073562f1125c6689e73325a36b0da8d70ee2c3419d24c864f29662d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d2eca4c3a17f5e16afc6114c1f29929

SHA1
0a170c6c81a913089b3c4bfe7747bebeb82b0b47

SHA256
562e202d97015a63119a35ccf32c9b6fb25dbf27b36318e351f1ebce49079b84

SHA512
fdd833d6483f79837f7ba3af870cfb48ae3501f5e45d1ace4b5d39938eeaef814c8c9841d41dafbdfd96344501842ae2a1f17311505ae091024710fc7045580f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56a0b93db1ea32748d8bd6c4ffd78f05

SHA1
73cee516b6dde7eed0c964a6543251dd46d98949

SHA256
5a9c41fd5bbb0059f963b77c50fab955a7ac03cfd81df39231dbb8a2b574a645

SHA512
f186700b1513a3b52baf9e5a967dc8ff21705c0bdd0f5b5492c449eab06335b446c659ce1c3d2b608daac26dd1cc60db6fe048cff988006420fe64c0754e2ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc00e9535ef998f8ae20973e98caade7

SHA1
bc6e155281df53e3fec30db2df63e46cc89e6bdc

SHA256
fa5accbb9cfb1866f512972bd4a0833f04386247e6de12be9e7ccc49a36a827b

SHA512
012ab77d4ea244c89e55c7832131e943312d210ccabe96919baf1dfd77b523130a55818fc0622e18aa66aea524138996fb07e4d3032adb8b8bfbcc37448e690b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE919.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE989.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit